Description

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:12.133Z",
  "pubdate": "2026-09-23T08:17:12.133Z",
  "executiveSummary": "A path traversal vulnerability has been identified within Foxit PDF Editor and Foxit PDF Reader that stems from improper validation of file paths during the processing of embedded PDF resources.\nThis flaw allows an attacker to manipulate the file system write operations associated with embedded resources, potentially resulting in the creation or overwrite of files outside of the intended directory structure.\nThe impact of this vulnerability is significant, as it can be leveraged to achieve arbitrary code execution by placing malicious files in sensitive locations, such as startup folders or application binary directories.\nSuccessful exploitation requires the victim to open a specially crafted PDF document, granting the attacker the ability to execute arbitrary commands within the context of the current user session.\nThis vulnerability poses a critical risk to organizational endpoints and systems relying on Foxit PDF products for document management, as it bypasses standard sandboxing mechanisms through resource injection.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient sanitization mechanism within the embedded resource processing logic of Foxit PDF Editor and Foxit PDF Reader.\nWhen a PDF document contains embedded files or associated resources, the application must resolve and map these objects to specific storage locations on the host file system.\nThe vulnerable component fails to correctly validate the file path identifiers provided within the PDF structure, failing to neutralize directory traversal sequences such as '../'.\nAn attacker can exploit this by embedding a malicious object within a PDF file and specifying a path that uses traversal characters to escape the designated working directory.\nWhen the application attempts to write the embedded resource to the disk, the lack of input validation allows the write operation to occur in an arbitrary directory defined by the attacker.\nThe attack flow commences when a target user opens the weaponized PDF file. The application engine parses the malicious resource metadata and proceeds to extract the embedded content.\nDue to the traversal vulnerability, the engine interprets the crafted path as a legitimate filesystem target, writing the malicious payload to a user-defined destination.\nIf the attacker targets executable paths or startup scripts, the subsequent execution of this file by the operating system or the user allows for arbitrary code execution with the privileges of the active application process.\nThis exploit does not inherently require authentication as it relies on the processing logic of the PDF engine itself, making it effective against users with standard user privileges.\nPost-exploitation impact typically involves full system compromise, as the attacker achieves execution of arbitrary commands, facilitating data exfiltration, lateral movement, or the installation of further persistent malicious components.\nThe vulnerability highlights a critical failure in the handling of external resource pointers, where trust is incorrectly placed in the input supplied within the document structure rather than enforcing a strict internal chroot-like environment or path normalization verification."
}